DPDP Board Readiness Checker

The DPDP Act primarily creates liability for the Data Fiduciary (the company). However, decisions made by directors that result in DPDP violations — especially deliberate or negligent decisions — can result in personal accountability. Directors should ensure they have received DPDP briefings and that compliance programmes are in place.

There is no explicit DPDP requirement for board adoption of a data protection policy, but best governance practice — and what regulators look at in enforcement actions — includes evidence that the board was aware of and committed to data protection. Board-adopted policies and board minutes create this evidence.

The board should approve the incident response plan before a breach occurs, and should be notified promptly when a significant breach occurs. The 72-hour DPB notification obligation often requires board-level decisions about disclosure — boards that have not planned for this will be reactive rather than prepared.